What is Watchdog
Watchdog is a service monitoring daemon responsible for rebooting the Apple TV if its GUI application is not running. Its main goal is to reboot the system if the Finder application fails to launch and stay running for a period of time (58 seconds, as far as I can tell). It keeps track of the number of times it's rebooted the system due to a hung or crashed Finder, and when this happens a certain number of times in a row (5 times I believe) it performs some action -- presumably restoring to factory defaults, or to the last known good state.
There's a kext called AppleTCOWatchdog.kext in the /System/Library/Extensions/ folder.
Brief Watchdog Background
Watchdog is a service monitoring daemon that has its roots in Apple's server OS, Mac OS X Server. Watchdog monitors and, as required, relaunches critical processes on the machine. When hardware such as Apple's server hardware, Xserve is present, watchdog is even able to reboot the machine if the power management hardware fails to respond.
This should not be confused with the "watchdog" program from OS X 10.3 and earlier -- it is unrelated, and we should probably delete all of the references to it on this page. :/
The Ripstop Daemon
Ripstop is a background system daemon launched by the launchd process in its role as the successor to mach_init. Ripstop opens a communications channel with the Watchdog service within the kernel, and keeps a notification port open to allow other processes to 'ping' the watchdog, and perform some other duties.
Ripstop responds to six notifications, all sent via the low-level
The Finder application actually sets up a timer which fires every 58 seconds to make the following call:
notify_post( "com.apple.riptide.heartbeat" );
This is essentially the 'keepalive' notification used to inform the watchdog that everything is hunky-dory.
Upon launch, ripstop switches to the Frontrow user